""ET INFO F5 BIG-IP - Command Execution via util/bash""

SID: 2049259

Revision: 1

Class Type: attempted-admin

Metadata: affected_product F5, attack_target Networking_Equipment, created_at 2023_11_20, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, updated_at 2023_11_20

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "/mgmt/tm/util/bash"

• Value: "|22|command|22|"

• Value: "|22|utilCmdArgs|22|"

Within:

PCRE:

Special Options:

• http_method

• http_uri

• fast_pattern

• http_client_body

• http_client_body

source